From b04cd6aadaa8b8327654969392a5d094f3995f6d Mon Sep 17 00:00:00 2001
From: David Tolnay <dtolnay@gmail.com>
Date: Thu, 18 Jun 2015 22:15:41 -0700
Subject: [PATCH] fix use after free in f_strptime

---
 builtin.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/builtin.c b/builtin.c
index 4d538eac..6dfb35d1 100644
--- a/builtin.c
+++ b/builtin.c
@@ -1056,13 +1056,15 @@ static jv f_strptime(jq_state *jq, jv a, jv b) {
     jv_free(b);
     return e;
   }
-  jv_free(a);
   jv_free(b);
-  if (tm.tm_wday == 0 && tm.tm_yday == 0 && my_mktime(&tm) == (time_t)-2)
+  if (tm.tm_wday == 0 && tm.tm_yday == 0 && my_mktime(&tm) == (time_t)-2) {
+    jv_free(a);
     return jv_invalid_with_msg(jv_string("strptime/1 not supported on this platform"));
+  }
   jv r = tm2jv(&tm);
   if (*end != '\0')
     r = jv_array_append(r, jv_string(end));
+  jv_free(a); // must come after `*end` because `end` is a pointer into `a`'s string
   return r;
 }
 #else